Hi, unfortunately I have some very complicated query based on this field, which is a basis for another complicated query etc... so I really need that. ... View more

Hi FrankVl, yea, I missed it. So the query should be: base search|stats sum(hours) as hours by task,domain,group | sort - hours | streamstats count | eventstats count as max_count | eval percent = round(exact(exact(count * 100) / max_count), 0) | search percent <= 5 | fields - count, max_count, percent ... View more

Hi MuS, thanks for your input. I run the search in Verbose mode. I guess there is some issue with my sourcetype (iisadv) but I'm unable to understand what exactly... ... View more

Hi, probably this is not a best solution but it works. just add this to the end of your query: base search|stats sum(hours) as hours by task,domain,group | sort - hours | streamstats count | eventstats count as max_count | eval percent = round(exact(exact(count * 100) / max_count), 0) | search percent <= 5 | fields - count, max_count, percent PS as FrankVl said I missed the "sort" command, so I edited this post to add it. ... View more

Hi If ns0:Code has only 1 value you can make the renaming before the timechart command so it should be: (some data- index, host, etc)............. | xmlkv | search "ns0:ApplicationFunction"=NotifyBusinessPartnerUpdate_Update_1 | replace "*" in ns0:Code with "ABC" | timechart count by ns0:Code ... View more

Hi, Sorry for a mistake. My new Splunk version is 7.2.1. I checked the annotate_punct on both Splunk itself and UF servers and it's in each place "True". So probably that's not my issue... ... View more

Hi If I understand you correct and you need an alert to trigger for both 0,0 and 1,1 conditions, I guess this is an easiest way (the actual query is only the last string): | makeresults | eval source="Primary_source",Status=1 | append [| makeresults | eval source="Secondory_source",Status=1 ] | stats dc(Status) as Status | where Status = 1 this will provide you a result only if both Statuses are 1 or both statuses are 0, and based on this you can create an alert. ... View more

Hi, Can you please clarify the statement for up and down because I'm not sure I understand you correct. I see 4 possible variants, can you please approve (or disprove and fix this table): 0,0 = Down 0,1 = Up 1,0=Up 1,1=Down is it correct? ... View more